A computer network is a collection of interconnected computing devices that can exchange data and share resources. In a packet-based network, such as the Internet, the computing devices communicate data by dividing the data into small blocks called packets, which are individually routed across the network from a source device to a destination device. The destination device extracts the data from the packets and assembles the data into its original form. Dividing the data into packets enables the source device to resend only those individual packets that may be lost during transmission.
The packets are communicated according to a communication protocol that defines the format of the packet. A typical packet, for example, includes a header carrying source and destination information, as well as a payload that carries the actual data. The de facto standard for communication in conventional packet-based networks, including the Internet, is the Internet Protocol (IP).
In some cases, a control source (CS) may require the system administrator to mirror network traffic flowing to and from a designated network user. The original network traffic is routed across the network as usual while a mirrored version of the network traffic is forwarded for analysis. Conventionally, flow capture of a network service, such as VoIP, has been enabled and managed by the system administrator interacting with a command line interface presented by a network device providing the network service. This technique may become difficult as the number of network services and respective devices increase. Delay and other difficulties may arise as both the number of filtering criteria entered and the number packet flows being monitored increases. For example, an undesirably long delay may occur from the time a new filtering criterion is entered until packets meeting the criterion may be captured.
Each of the filtering criteria may have one or more associated timeouts that indicate when the filtering criterion expires. Typically, a timer is defined for each timeout, and the timeouts are updated whenever packets are received that match the filtering criterion. This approach requires an operating system of the network device performing the monitoring to provide support for an extremely large number of timers. The operating system typically maintains the timers within kernel memory, and software applications executing on the monitoring network device repeatedly invoke the operating system to utilize the timers.